Technical debt should be quarantined, not structural. That's the one, most important thing to take away. A really messy view with tangled if statements and hacks to get things to work isn't great, but it's leagues better than a really messy controller because it isn't going to introduce ACL errors. A really messy controller is leagues better than a fucked schema / data model because it doesn't spread the poison across every endpoint in your application.

Some easy wins are to default to making something a "many", even if it is only a "one" or a "one or none" because it makes adding a second case much easier. For example, a user should have multiple roles at multiple projects by default, so business users can do fine grain control over permissions.

Another useful trick is to have default behaviour, but introduce a set of tables for custom settings. This makes it easier to make changes because you don't need to run a migration to add a column to a table, you just write a new record to the "user_overrides" table.

But at the very end of the day, taking on technical debt of any kind can be warranted. It all depends on the stakes. If you need to get something done in a week to close a company-saving deal, then fucking do it. Fix it later. The implied interest rate might be 1000%, but if it saves the company it is worth it.